Quantum key distribution secure against the efficiency loophole 
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An efficiency-loophole-free quantum key distribution (QKD) scheme is proposed, which involves 
no hardware change but a modification in the data post-processing step. The scheme applies to a 
generic class of detection systems which allow correlations between the detection efficiency and the 
outcomes. We study the system transmittance and the detection error rate that allow implementing 
this scheme. We also consider the case that a quantum memory is used to boost the performance 
and investigate the criteria of the readout probability. The simulation result shows that the lowest 
tolerable system transmittance (readout probability) is 50%, while the necessary efficiency for an 
efficiency-loophole-free Bell's inequality test is 82.8%. 

PACS numbers: 



Bell's inequalities [l[ play a critical role in testing 
against alternative theories of quantum mechanics, like 
the local hidden variable theory. Following the early Bell 
test experiments 0, Q , there are many experiments per- 
formed in the last decade 0, [H, 0, 0] that have favored 
quantum mechanics. However, the locality loophole |8| 
and the efficiency loophole (or fair sampling problem) [9] 
block these experiments to draw a decisively conclusion. 
Note that no Bell test experiment has been done so far 
to close all these loopholes simultaneously. 

The efficiency loophole exists when the data post- 
processing only focuses on a certain part, but not all, of 
the prepared states. For instance, in many Bell test ex- 
periments (especially for optical implementations), data 
used to test the inequality are conditional on coincidence 
events, where detections occur in both wings of the exper- 
iment. The underlying assumption for this post-selecting 
is that the sample of detected states is representative of 
all the states prepared. Unfortunately, this fair sampling 
assumption can not be tested (proved) from the experi- 
ment. This is normally called detection efficiency loop- 
hole or fair sampling problem. 

Since the concept of entanglement is closely related to 
Bell's inequalities [13] and entanglement is the precondi- 
tion of quantum key distribution (QKD) security [l(|, a 
natural question is "Does this efficiency loophole affect 
the security of QKD?" The answer is yes. 

In th eory , the security of QKD has been proven in lit- 
erature [H], [HI, EH • When it comes to real- life implemen- 
tations, various device imperfections should be taken into 
consideration. A lot of efforts have been made to achieve 
the security of QKD with realistic devices 14|, |l5[ . Nev- 



ertheless, not all the imperfections have been fully ex- 
amined yet. Hence, these security analyses cannot be 
applied to some realistic cases. For example, the efficien- 
cies of two detectors (one detects and the other detects 
1) in a QKD system may not be the same, which opens 
up a loophole to attacks such as the efficiency mismatch 
attack [3| and the time-shift attack [13]. Note that the 
time-shift attack has been successfully demonstrated in 



lab recently [l8|. A simple counter measure on the sin- 
gle photon level to these two attacks exists by randomly 
switching two detectors However, this counter 

measure does not close the efficiency loophole and fur- 
ther attacks can be launched [2l| . All in all, the system 
transmission efficiency opens a loophole to QKD attacks. 
This loophole stems from the aforementioned fair sam- 
pling problem in Bell's inequality test. 

In this Letter, we examine a typical detection sys- 
tem and explain why the efficiency loophole exists in 
QKD. We then propose an efficiency-loophole-free QKD 
scheme. The proposed scheme differs from the existing 
QKD schemes only in the classical data post-processing 
procedure, mainly the privacy amplification part. No 
hardware change is required for the new scheme. Finally, 
we apply it to various photon sources with and without 
quantum memory to show the criteria for QKD devices 
to implement this scheme. 

There are two types of QKD schemes. In the prepare- 
and-measure scheme, Alice, the sender, prepares a state 
and sends it to Bob, the receiver. In the entanglement 
based scheme, an eavesdropper, Eve, prepares a bipartite 
state for Alice and Bob. In the security proof, we assume 
that Eve controls the channel. Thus, in either cases, the 
state to be detected is prepared by Eve. In general, the 
state coming to a detection system can be in an arbitrary- 
dimensional Hilbert space. The following discussion will 
focus on the prepare-and-measure case, where we only 
need to consider the detection system on Bob's side. For 
the entanglement based scheme, Alice's detection system 
is the same as Bob's. 

In the following discussion, we will focus on a generic 
case that the detection system is composed of two de- 
tectors (for bit and 1). Then, in a real experiment, 
there are four possible outputs: neither of the detector 
clicks (no click), one detector clicks (0), the other detec- 
tor clicks (1) and both detectors click (double click). A 
traditional data pre-processing works as follows: discard 
all no clicks, keep single clicks and randomly assign or 
1 to double clicks. 
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In theory, a so-called squashing model is widely used 



in security proofs of QKD [14|, |15|. Note that security 
proofs of QKD with a threshold detector model [35| , are 
presented [i^, 3, 24 1 recently. 

Squashing model: A detection system first per- 
forms an operation F mapping the incoming state p 
(in an arbitrary-dimensional Hilbert space) into a two- 
dimensional pace (qubit) state p 2 with an ancillary state 
Pf (in an arbitrary-dimensional space). Then two mea- 
surements are performed on p 2 with outcome 0/1 and on 
Pf with outcome of a flag showing no / single / double click. 
Note that both measurements of M and Mf may depend 
on the basis choice. The schematic diagram is shown in 

Fig. m 
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FIG. 1: A schematic diagram for a detection system. The 
operator (F) is the key component of the squashing model, 
which projects the incoming state p into a qubit state p2 and 
a flag state pf. The measurement outcome of the flag state 
pf gives Bob information about no/single/double click. 

Typical security proofs of QKD rely on the assumption 
that the measurement outcome on pf is independent of 
the squashed qubit p 2 . With this assumption, Alice and 
Bob can safely discard all no clicks and focus on other 
detections in the post-processing. In reality, this assump- 
tion might not be valid. One example is the time-shift 



attack [17} . Similar to Bell's inequality tests, this is where 



the efficiency loophole (or fair sampling problem) comes 
into the scenario. 

One way to close the efficiency loophole in QKD is 
by making the overall transmittance to be 100%. This is 
not feasible with current technology. From the discussion 
above, we already know that the fair sampling problem 
exists in QKD because of discarding no clicks in the data 
pre-processing. In order to have an efficiency-loopholc- 
free QKD scheme, we only need to modify the data pre- 
processing: keep single clicks and randomly assign or 
1 for no clicks and double clicks. Now that the data 
from all states are used for the post-processing, the fair 
sampling problem is avoided. 

With this modified pre-processing, Bob always detects 
or 1 for each pulse sent by Alice. It is equivalent to 
say that the system transmittance is 100%. On the other 
hand, Bob has extra information from the measurement 
on the flag state pf. Shortly, we will see that this infor- 
mation is useful for key generation. Now, the definitions 
of gain and quantum bit error rate (QBER) are different 
from the traditional ones, where the data post-processing 



only focuses on the single and double clicks. Define Q s 
to be the rate for Bob to get a single click. Define E s 
to be the error rate given that Bob gets a single click. 
Note that both quantities, Q s and E s , can be experi- 
mentally measured or tested. The QBER with the new 
pre-processing is given by 



8 = E s Q s + e (l-Q s ), 



(1) 



where the second term is due to the random bit assign- 
ment for the double clicks and no clicks and eq = 1/2. 
There are two types of errors: system errors, with a rate 
of E g , and the ones caused by random bit assigning, with 
a rate of eo = 1/2. 

Basis independent source: There are two types 
of basis independent sources [3] : perfect single photon 
source and entangled photon source (25[. For a QKD 
system using a basis independent source, the phase error 
probability is the same as the bit error probability, 



s p = s b = s, 



(2) 



where the QBER S is given by Eq. (fTJ). Here we consider 
the infinite key length limit. Then the key rate is given 
by [3 



R>1-H 2 (S)-H 2 (5), 



(3) 



where H 2 (x) = — x\og 2 (x) — (1 — x)log 2 (l — x) is the 
binary entropy function. 

As mentioned above, in the efficiency-loophole-free 
QKD scheme, Bob randomly assigns or 1 for no clicks 
and double clicks. One observation is that Bob knows 
the location of the random bits. In the squash model we 
described in Fig. [TJ this location information comes from 
the measurement on the flag state pf. Hence, he can 
group the key bits into two strings: the one coming from 
single clicks (s s ) and the other from random assignments 
(s r ). Alice and Bob together can experimentally test the 
error rate in s s , which is E s . Suppose the phase error 
rates in s s and s r are E ps and E pr , respectively, then the 
overall phase error probability 5 P can be expressed by (in 
the long key limit), S p = Q s E ps + (1 — Q s )E pr . Due to 
the fact that < Q s < 1 and E pr > 0, we can have the 
upper bound of the phase error rate in s s , 



E ps — — — — 



(4) 



Thus the key rate from the single click part is given by 



R>Qs[l~H 2 (E s )-H 2 (- 



(5) 



where S is given by Eq. |T]) . We know that no positive key 
can be extracted from the random bit string. So Eq. ([5|) 
gives a lower bound of the overall key rate. Thus, in the 
post-processing, Alice and Bob discard all no clicks and 
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double clicks, and perform error correction and privacy 
amplification on the bits from single clicks according to 
Eq. ([5]). From here we can see that the new scheme differs 
from the traditional one in two aspects. 

f. Double clicks are discarded in the new scheme, 
while they are randomly assigned to be 0/f in the 
traditional scheme. 

2. More privacy amplification is performed in the new 
scheme according to Eq. ([5|). 

To illustrate the intuition behind Eq. fU, let us first 
consider two attacks with a simple case where E s — 0. 
When E s = 0, we can directly conclude from Eq. ([5]) that 
Q s > 0.5 is the lowest tolerable single click rate. 

The extreme case of time-shift attack [17]: Eve 
can control detectors to be active (100% efficiency) or 
inactive (0% efficiency) . A simple attack is that Eve ran- 
domly chooses one of the two detectors to be active and 
the other inactive. In this case, Eve knows all the in- 
formation about the key and introduces 50% loss, which 
follows Q s < 0.5. No positive key can be obtained from 
Eq. ([5]) in this case. 

The strong pulse attack 26] : Eve randomly chooses 
a basis to measure the state sent by Alice and replace it 
with a strong pulse according to the measurement result. 
For example, Eve chooses X basis measurement and ob- 
tains an outcome of +. She resends many copies of + 
state. In this case, Bob gets either a + outcome (if he 
chooses X basis measurement) or a double click (with a 
high probability if he chooses Z basis measurement) with 
equal probabilities. Again, in this case, we get Q s < 0.5, 
which leads no positive key from Eq. ([5]). 

Since the lowest tolerable transmittance (roughly Q s ) 
is around 50% and we know that the dark count rate is 
low, typically below 10 -4 , in the following simulations, 
we neglect the dark counts. 

Now, let us study a simple case that Alice uses a single 
photon source. From Eq. ([1]), the single click rate and its 
error rate are given by 



Qs = V, 
E s = e d , 
S = e d r] + e (l - rj), 



(6) 



where r\ is the overall transmittance, taking into account 
the channel loss and the detection efficiency, and is 
the intrinsic detection error probability. Now we can see 
that there are two crucial QKD system parameters, 
and r], determining the key rate given by Eq. ([5]). The 
lower bound for the tolerable ed and r\ is shown in Fig. [2] 
A parametric down-conversion (PDC) source is widely 
used as an entangled photon source, which is another 
type of basis independent source. Following the model 
presented in Ref. [25j, one can calculate the single click 
rate, its error probability and then the key rate by 



Eq. ([5]) . We have numerically checked all possible choice 
of the source intensities /x, but no positive key rate R by 
Eq. ([5]) can be achieved. 

Coherent state source: Now, let us consider another 
case that a weak coherent state photon source is used. 
Here we apply the GLLP security analysis [lj| to the 

Similar to the deriva- 



decoy state QKD scheme [27, 
tion of Eq. ((5|) , the key rate of the efficiency- loophole- free 
QKD scheme with a coherent state source is given by 



RZ-QaH^EJ + PiYill 



(7) 



where Y\ is the probability that Bob gets a single click 
given Alice sends out a single photon state, P\ — fj,e~^ 
is the probability Alice sends out a single photon state, 
and Si is the error rate of the single photon states in- 
cluding random bit assignment. The single photon state 
yield Yi and its error rate e\ can be estimated by decoy 
states. Assume that the overall transmittance is rj, then 
the parameters Y\ and 5\ are given by 



Yi = t], 

Si = e d Yi + eo(l-Yj), 



(8) 



Here in the simulation, we neglect dark counts and double 
clicks, so that Q s — Q h 



1 - and E, 



E„ 



en. We can see that when /x approaches to 0, Eq. ((7} 
will converge to Eq. ([5]) except for an overall ratio. To 
illustrate the criteria for case of decoy state QKD with 
coherent state source, we pick up a typical value of \i used 
in real experiments, \i — 0.5, for the simulation. Now, 
we can find the relation between the tolerable e c i and rj, 
as shown in Fig. [5] 

From Fig. [2l we know that the transmittance, rj, is re- 
quired to be higher than 50% for a QKD system even 
when a perfect single photon source is used. With the 
current (optical) technology, it is not feasible yet. One 
way to solve this problem would be to perform a quan- 
tum non-demolition (QND) measurement, distinguishing 
vacuum and non-vacuum states, right before Bob's box. 
This QND measurement gives Bob a trigger when the in- 
coming signal is a vacuum or not. Since Bob chooses the 
basis (randomly) after the QND measurement, the secu- 
rity only relies on the state conditional on the trigger. 
Note that this QND measurement can also help close the 
efficiency loophole in the Bell's inequality test. 

One candidate for this QND measurement is using 
a quantum memory. The requirements for a quantum 
memory to be used in the efficiency-loophole-free QKD 
scheme are listed as follows. 

1 . The quantum memory can tell whether a photon is 
stored or not. When a photon is stored, a trigger 
will be emitted. 

2. Given that the quantum memory emits a trigger, 
the readout probability is tjm, which takes into ac- 
count the detection efficiency and the mis-trigger 
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probability. The quantum memory is not required 
to re-emits photons for readout. A measurement 
can be performed on the quantum memory directly. 

3. The user can choose measurement basis after the 
quantum memory sends out a trigger. Then the 
security only relies on the quantum state stored 
in the quantum memory. Thus, only the readout 
efficiency (normally less than 100%) will cause the 
random sampling problem. 

We remark that the quantum relay j2f| can be used 
for the QND measurement as well. 

In the case that a basis- independent source (e.g., an 
entangled PDC source) is used, we can use Eq. © in 
Eq. ([5]). In this case, rj is replaced by the readout prob- 
ability of the quantum memory, r/A/. The tolerable t]m 
and e<2 will be the same as the "Perfect single photon 
source" curve shown in Fig. [5] 

For the case that a weak coherent state photon source 
is used, we have 
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FIG. 2: Plot of the lower bound of the tolerable e<j and rj 
(t)m) for the efficiency-loophole-free QKD scheme. For the 
two cases with coherent states, we pick up /i = 0.5 for the 
simulation. For the case of Coherent+decoy+memory, we as- 
sume the channel transmission is 77c = 1%. 



1 1 _ e -»)cM ' 
Q s =Yi = r]M, 
E s = e d , 

S\ = edJ]M + eo(l - t)m), 



(9) 



where ry c is the channel transmittance, or the probabil- 
ity of the quantum memory to send out a trigger signal 
given that Alice sends out a photon. One can use Eq. (J9j) 
in Eq. ([7]) to get the hnal secure key rate. Here the def- 
initions of parameters, 5i, P\ and Y\, are different from 
the case without a quantum memory. In this case, these 
probabilities are conditional on the trigger sent by the 
quantum memory. Since they have close physical mean- 
ings, we will use the same set of notations for simplicity. 
In a real experiment, R, Si, P\ and Y± can be estimated 
by decoy states. In the simulation, we use rj c = 1%, cor- 
responding to a 100 km fiber link loss, and /i = 0.5. The 
result is shown in Fig. [2l 

In Fig. [2l there is no positive key in the regime E > 
11.0% for the single photon source case, which is consis- 
tent with the result in the literature [13]. Note that the 
y-axes are different for the Coherent+decoy+no memory 
and Coherent+decoy+memory curves. 

Conclusion remarks: 

1. One can also search for better post-processing 
schemes, such as those based on two-way classical 
communications in the post-processing [aaEi. An 
interesting question is whether the transmittance 
r\ > 50% is a hard limit for efficiency-loophole-free 
QKD schemes. 

2. Proving the equivalence between the squash model 
presented in Fig. [1] and the threshold detector 



model, like Ref. [24j, is an interesting prospective 
topic. 

3. The idea of discarding random assignment bits and 
doing more privacy amplification can be applied to 
the normal QKD scheme where random bits are 
assigned for double clicks. 

4. Although the scheme is proposed for QKD usage, 
the post-processing idea may also be useful for 
efficiency- loophole- free Bell's inequ ality test, where 
the necessary efficiency is 82.8% [32j. This effi- 
ciency criterion for Bell's inequality test has been 
improved by choosing the optimal set of measure- 
ments [33]. In future, it is interesting to investigate 
whether this technique is useful for the proposed 
QKD scheme. 
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